CVE-2026-53638: Sylius eCommerce Framework Auth Bypass Flaw

CVE-2026-53638 Overview

CVE-2026-53638 is an authorization bypass vulnerability in Sylius, an open source eCommerce framework built on Symfony. The flaw affects the shop account API in versions 2.0.0 through 2.0.17, 2.1.0 through 2.1.14, and 2.2.0 through 2.2.5. An authenticated customer can assign any globally enabled payment method to a placed order, including methods the store operator has excluded from the order's channel. The issue is tracked under CWE-863: Incorrect Authorization and fixed in versions 2.0.18, 2.1.15, and 2.2.6.

Critical Impact
Authenticated shop customers can bypass channel-level payment method restrictions, using globally enabled payment methods that store operators have explicitly disabled for a specific sales channel.

Affected Products

Sylius 2.0.0 through 2.0.17
Sylius 2.1.0 through 2.1.14
Sylius 2.2.0 through 2.2.5

Discovery Timeline

2026-09-08 - CVE-2026-53638 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-53638

Vulnerability Analysis

The vulnerability resides in the shop account API endpoint PATCH /api/v2/shop/account/orders/{tokenValue}/payments/{paymentId}. This endpoint allows an authenticated shop customer to change the payment method of an order that has been placed but not yet paid, when the order is in the STATE_NEW state.

The endpoint does not validate that the chosen payment method is enabled for the order's channel. In contrast, the equivalent checkout endpoint at PATCH /api/v2/shop/orders/{tokenValue}/payments/{paymentId} correctly rejects out-of-channel payment methods with an HTTP 422 response. The account variant silently accepts them and returns HTTP 200.

The practical impact is that an authenticated customer can assign any globally enabled payment method to their own placed order. This bypasses channel-scoped configuration used by merchants to restrict payment options per storefront, region, or currency, undermining commerce integrity controls.

Root Cause

The root cause is a missing authorization check in the Sylius\Bundle\ApiBundle\Changer\PaymentMethodChangerInterface service. The account endpoint verifies order ownership and state but omits the channel-scoped validation implemented in the checkout flow. This inconsistency creates a broken access control condition classified as [CWE-863].

Attack Vector

Exploitation requires an authenticated shop customer account and a placed order in the STATE_NEW state. The attacker sends a PATCH request to the vulnerable account endpoint referencing the target tokenValue and paymentId, supplying a payment method identifier that is globally enabled but excluded from the order's channel. The server accepts the change and updates the payment method without validating channel eligibility. See the GitHub Security Advisory GHSA-6955-hrm5-c4qp for endpoint details.

Detection Methods for CVE-2026-53638

Indicators of Compromise

Successful HTTP 200 responses to PATCH /api/v2/shop/account/orders/{tokenValue}/payments/{paymentId} requests from authenticated customers
Orders in STATE_NEW state whose assigned payment method is not enabled for the order's channel
Audit log entries showing payment method changes on placed orders that reference payment methods restricted from the associated channel

Detection Strategies

Review web server access logs for PATCH requests targeting the /api/v2/shop/account/orders/*/payments/* path pattern and correlate with order channel configuration
Query the Sylius database for orders where sylius_order.channel_id does not match any channel present in the sylius_payment_method_channels join for the assigned payment method
Compare payment method assignments against merchant-defined channel restrictions to identify anomalous combinations

Monitoring Recommendations

Enable request logging for all shop account API endpoints and forward events to a centralized log store
Alert on payment method changes occurring after order placement, particularly those originating from the account API rather than the checkout API
Track unusual patterns of payment method modifications by customer account, flagging accounts that repeatedly change payment methods on STATE_NEW orders

How to Mitigate CVE-2026-53638

Immediate Actions Required

Upgrade Sylius to version 2.0.18, 2.1.15, or 2.2.6 or later, matching your current major and minor branch
Audit existing STATE_NEW orders for payment method assignments inconsistent with the channel configuration and correct or cancel affected orders
Review payment processor reconciliation records to identify transactions initiated through disabled channel payment methods

Patch Information

The Sylius maintainers released fixes in versions 2.0.18, 2.1.15, and 2.2.6. The patch adds channel validation to the shop account payment method change endpoint so it enforces the same channel-scoped payment method rules as the checkout endpoint. Full patch details are available in the GitHub Security Advisory GHSA-6955-hrm5-c4qp.

Workarounds

Decorate the Sylius\Bundle\ApiBundle\Changer\PaymentMethodChangerInterface service in the application to enforce channel validation before persisting the payment method change
Restrict access to the /api/v2/shop/account/orders/*/payments/* endpoint at the web server or API gateway layer until the upgrade is applied
Temporarily disable customer-initiated payment method changes on placed orders by returning an error from a decorated service implementation

bash

# Upgrade Sylius via Composer to a fixed release matching your branch
composer require sylius/sylius:^2.2.6 --update-with-dependencies
# Or for the 2.1.x branch
composer require sylius/sylius:^2.1.15 --update-with-dependencies
# Or for the 2.0.x branch
composer require sylius/sylius:^2.0.18 --update-with-dependencies